⬢ DragonFlyBSD Kernel Audit
DF-4055 / dmesg_s1.txt
← back to finding ↓ download raw
dfet: === go=1: dispatching REAL kernel handlers (built-in 'device et'): et_intr=0xffffffff804b8bd0 et_txeof=0xffffffff804b6740 et_stop=0xffffffff804b5ed0 et_tick=0xffffffff804b87d0 et_newbuf_hdr=0xffffffff804b9450 et_newbuf_cluster=0xffffffff804b9460 ===
dfet: layout: sizeof(et_softc)=0x85c8 sc_tick=0x400 sc_rx_data=0x520 sc_tx_data=0x6568 sc_rxstat_ring=0x480 sc_rx_status=0x4a8 if_timer=0x6a MHLEN=248 MCLBYTES=2048 ET_RX_NSTAT=1024 ET_TX_NDESC=512
dfet: dma: tx_ring=0x100000 rxst=0x106000 rxsd=0xbdfc000
dfet: setup complete: rings armed by REAL et_newbuf_hdr/et_newbuf_cluster (2 x 512 mbufs), serializer ready
dfet: S1[0]: slot=0 crafted LEN=60000 BUFIDX=0 RINGIDX=1 (cluster ring); dispatching REAL et_intr under serializer
dfet: if_input: m=0xfffff80089786400 m_len=59996 pkthdr.len=59996 M_EXT=1 ext_size=2048 (backing-store capacity) rcvif=dfet0
dfet:   frame[0..17]=ff ff ff ff ff ff 00 df 40 55 00 01 df 55 0e 0f 10 11
dfet:   OOB: m_len exceeds backing store by 57948 bytes; heap bytes [2048..2080) past the cluster: 6174696f6e20616e 640a232050617373 776f726441757468 656e746963617469
dfet: S1[1]: slot=1 crafted LEN=60000 BUFIDX=1 RINGIDX=1 (cluster ring); dispatching REAL et_intr under serializer
dfet: if_input: m=0xfffff80089786200 m_len=59996 pkthdr.len=59996 M_EXT=1 ext_size=2048 (backing-store capacity) rcvif=dfet0
dfet:   frame[0..17]=ff ff ff ff ff ff 00 df 40 55 00 02 df 55 0f 10 11 12
dfet:   OOB: m_len exceeds backing store by 57948 bytes; heap bytes [2048..2080) past the cluster: ffffffffffff00df 40550001df550e0f 1011121314151617 18191a1b1c1d1e1f
dfet: S1[2]: slot=2 crafted LEN=60000 BUFIDX=2 RINGIDX=1 (cluster ring); dispatching REAL et_intr under serializer
dfet: if_input: m=0xfffff80089785e00 m_len=59996 pkthdr.len=59996 M_EXT=1 ext_size=2048 (backing-store capacity) rcvif=dfet0
dfet:   frame[0..17]=ff ff ff ff ff ff 00 df 40 55 00 03 df 55 10 11 12 13
dfet:   OOB: m_len exceeds backing store by 57948 bytes; heap bytes [2048..2080) past the cluster: 0000000000000000 0000010052540012 345652550a000202 0800400000000000
dfet: S1: delivered=3 oob_events=3 ipackets=3 ierrors=0 (MHLEN=248 MCLBYTES=2048; claimed buflen=60000)
dfet: *** S1 BUG CONFIRMED (DF-4055): the REAL et_intr/inlined-et_rxeof handed if_input mbufs with m_len=59996 on a 2048-byte cluster 3/3 times - m_len runs 57948 bytes past the allocation (if_et.c:1863,1896); bytes past the cluster are adjacent kernel heap ***